CVE-2024-0624

The Paid Memberships Pro – Content Restriction, User Registration, & Paid Subscriptions plugin for WordPress is vulnerable to Cross-Site Request Forgery in all versions up to, and including, 2.12.7. This is due to missing or incorrect nonce validation on the pmpro_update_level_order() function. This makes it possible for unauthenticated attackers to update the order of levels via a forged request granted they can trick a site administrator into performing an action such as clicking on a link.
Configurations

Configuration 1 (hide)

cpe:2.3:a:strangerstudios:paid_memberships_pro:*:*:*:*:*:wordpress:*:*

History

21 Nov 2024, 08:47

Type Values Removed Values Added
References () https://plugins.trac.wordpress.org/browser/paid-memberships-pro/trunk/includes/services.php#L139 - Product () https://plugins.trac.wordpress.org/browser/paid-memberships-pro/trunk/includes/services.php#L139 - Product
References () https://plugins.trac.wordpress.org/changeset/3025164/paid-memberships-pro/tags/2.12.8/includes/services.php - Patch () https://plugins.trac.wordpress.org/changeset/3025164/paid-memberships-pro/tags/2.12.8/includes/services.php - Patch
References () https://www.wordfence.com/threat-intel/vulnerabilities/id/ae68d083-b6e2-409b-8c91-d4eb7e62dba9?source=cve - Third Party Advisory () https://www.wordfence.com/threat-intel/vulnerabilities/id/ae68d083-b6e2-409b-8c91-d4eb7e62dba9?source=cve - Third Party Advisory

31 Jan 2024, 19:03

Type Values Removed Values Added
References () https://www.wordfence.com/threat-intel/vulnerabilities/id/ae68d083-b6e2-409b-8c91-d4eb7e62dba9?source=cve - () https://www.wordfence.com/threat-intel/vulnerabilities/id/ae68d083-b6e2-409b-8c91-d4eb7e62dba9?source=cve - Third Party Advisory
References () https://plugins.trac.wordpress.org/changeset/3025164/paid-memberships-pro/tags/2.12.8/includes/services.php - () https://plugins.trac.wordpress.org/changeset/3025164/paid-memberships-pro/tags/2.12.8/includes/services.php - Patch
References () https://plugins.trac.wordpress.org/browser/paid-memberships-pro/trunk/includes/services.php#L139 - () https://plugins.trac.wordpress.org/browser/paid-memberships-pro/trunk/includes/services.php#L139 - Product
CVSS v2 : unknown
v3 : unknown
v2 : unknown
v3 : 5.3
CPE cpe:2.3:a:strangerstudios:paid_memberships_pro:*:*:*:*:*:wordpress:*:*
CWE CWE-352
First Time Strangerstudios paid Memberships Pro
Strangerstudios

25 Jan 2024, 02:15

Type Values Removed Values Added
New CVE

Information

Published : 2024-01-25 02:15

Updated : 2024-11-21 08:47


NVD link : CVE-2024-0624

Mitre link : CVE-2024-0624

CVE.ORG link : CVE-2024-0624


JSON object : View

Products Affected

strangerstudios

  • paid_memberships_pro
CWE
CWE-352

Cross-Site Request Forgery (CSRF)